Basic Work With libpcap - Understanding The IP header

• On interface 'ppp0', libpcap will strip the PPP header, and give us the IP packet.
• The contents of an IP packet's headers are 20 bytes (+ optional options).
• interesting fields:
  • first nibble (4 bits) - number of 4-byte words in the header.
  • byte 9 - type of protocol passed in the payload.
  • word at bytes 12-15 - source IP address, in network byte order.
  • word at bytes 16-19 - destination IP address, in network byte order.

Originally written by guy keren